On this page
The HIPAA Privacy Rule is the federal rule that sets national standards for how covered entities and their business associates may use and disclose protected health information (PHI), and it gives patients rights over their own records; HHS calls it "a set of national standards for the protection of certain health information" (HHS). For marketing, its key lines are the definition of marketing in 45 CFR 164.501 and the rule in 164.508 that a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing," with narrow exceptions (eCFR). Curve Compliance, which signs a BAA on every plan and strips PHI before data reaches an ad platform, checked each source below on November 2, 2026.
Book a call. Running ads for a clinic, practice or telehealth brand? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
The Privacy Rule at a glance
| Question | Short answer | Where it lives |
|---|---|---|
| Who must follow it? | Health plans, health care clearinghouses, health care providers that transmit health information electronically in a covered transaction, and business associates where the rule says so | 45 CFR 160.102; 164.500 |
| What does it protect? | Individually identifiable health information held or transmitted in any form, called PHI | 45 CFR 160.103 |
| What is the default rule? | No use or disclosure unless the rule permits or requires it, or the patient authorizes it in writing | HHS |
| What about marketing? | An authorization is needed for most uses or disclosures of PHI for marketing | 164.501; 164.508(a)(3) |
| Can PHI be sold? | Not without an authorization that states the disclosure will result in remuneration | 164.502(a)(5)(ii); 164.508(a)(4) |
| How much may be shared? | Reasonable efforts to limit PHI to the minimum necessary, with listed exceptions | 164.502(b) |
| What rights do patients have? | Notice, access, amendment, an accounting of disclosures, restriction requests and confidential communications | 164.520 to 164.528 |
| What must the organization run? | A privacy official, training, safeguards, a complaint process and six-year documentation | 164.530 |
| Since when? | April 14, 2003 for most covered entities; April 14, 2004 for small health plans | HHS |
What the Privacy Rule is
HHS issued the Privacy Rule to implement the Health Insurance Portability and Accountability Act of 1996. The final rule was published December 28, 2000, modifications followed on August 14, 2002, and all covered entities except small health plans "must have been compliant with the Privacy Rule by April 14, 2003" (HHS). The rule text sits at 45 CFR Part 160 and Part 164, Subparts A and E. Within HHS, the Office for Civil Rights "has responsibility for implementing and enforcing the Privacy Rule" (HHS).
It sits beside the Security Rule, which covers electronic PHI, and the Breach Notification Rule. For all of them on one page, see the HIPAA rules explained; for the Security Rule's three safeguard types, see HIPAA safeguards.
Who it applies to
The rule applies to health plans, health care clearinghouses and "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter" (45 CFR 160.102). HHS adds a point many small practices miss: "Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction" (HHS). See what a HIPAA covered entity is.
Business associates, the vendors that create, receive, maintain or transmit PHI for a covered entity (45 CFR 160.103), "may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement" or by law (45 CFR 164.502(a)(3)). See what a business associate is.
What information it protects
The rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, "in any form or media, whether electronic, paper, or oral" (HHS). The regulation excludes education records covered by FERPA, employment records held by a covered entity as employer, and records about "a person who has been deceased for more than 50 years" (45 CFR 160.103).
De-identified data is outside the rule: "There are no restrictions on the use or disclosure of de-identified health information" (HHS). For the definitions in more depth, see what IIHI is, what counts as PHI on a website and de-identified data under HIPAA.
Permitted uses and disclosures
The basic principle, in HHS's words: "A major purpose of the Privacy Rule is to define and limit the circumstances in which an individual's protected heath information may be used or disclosed by covered entities." A covered entity may use or disclose PHI only as the rule permits or requires, or as the patient authorizes in writing (HHS).
HHS lists six permitted purposes that need no authorization: to the individual; treatment, payment and health care operations; with an opportunity to agree or object; incident to an otherwise permitted use; public interest and benefit activities; and a limited data set for research, public health or health care operations (HHS). See treatment, payment and operations, permitted, incidental and unauthorized disclosures and the limited data set.
Marketing under the Privacy Rule
The regulation defines marketing as "to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service" (45 CFR 164.501). Refill reminders are carved out if any payment for them is reasonably related to what it costs to send them, and so are treatment, care coordination and a covered entity's descriptions of its own health-related services, "except where the covered entity receives financial remuneration in exchange for making the communication." Financial remuneration "means direct or indirect payment from or on behalf of a third party whose product or service is being described" (eCFR).
Any use or disclosure of PHI for marketing needs the patient's authorization, "except if the communication is in the form of" a face-to-face communication or "A promotional gift of nominal value provided by the covered entity." If a third party pays the covered entity, "the authorization must state that such remuneration is involved" (45 CFR 164.508(a)(3)). Selling PHI is a separate ban: a covered entity or business associate "may not sell protected health information" except under an authorization that says the disclosure "will result in remuneration to the covered entity" (164.502(a)(5)(ii); 164.508(a)(4)). These limits were tightened in 2013; see what the Omnibus Rule changed. For what a valid authorization must contain, see HIPAA marketing authorization.
Minimum necessary
HHS calls it "A central aspect of the Privacy Rule." When using or disclosing PHI, a covered entity or business associate "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (45 CFR 164.502(b); HHS). For a marketing team, the question is whether each tool gets only the fields it needs. See minimum necessary and ad tracking.
Patient rights
- Notice of privacy practices. A covered entity with a website about its services "must prominently post its notice on the web site" (45 CFR 164.520(c)(3)). See the notice of privacy practices.
- Access. The covered entity "must act on a request for access no later than 30 days after receipt of the request," with one extension allowed (45 CFR 164.524).
- Accounting of disclosures. A right to an accounting of disclosures "in the six years prior to the date on which the accounting is requested," with exceptions such as treatment, payment and operations (45 CFR 164.528).
- Restrictions. A covered entity must agree not to disclose to a health plan an item or service the patient has "paid the covered entity in full" for, when the disclosure is for payment or operations (45 CFR 164.522).
The Privacy Rule online: pixels and forms
HHS's tracking bulletin applies the Privacy Rule to websites and apps. Regulated entities may not use tracking technologies "in a manner that would result in impermissible disclosures" of PHI to tracking vendors, and "disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures." A consent banner does not fix that: "Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization" (HHS).
A federal court vacated part of the bulletin on June 20, 2024: the part about tools that connect a visitor's IP address with a visit to an unauthenticated public page about specific health conditions or providers (HHS). Portals, booking flows and health forms are a different case. See what the court changed. If your booking or intake pages still load ad pixels, book a call and Curve's team will walk through what each platform receives today.
How Curve Compliance helps
Curve Compliance works on the marketing and website tracking side of the Privacy Rule. Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted.
For forms, Curve Forms are hosted by Curve under the BAA it signs on every plan, with separate checkboxes for privacy consent and marketing consent, and form answers are never sent to ad platforms. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. Curve handles the tracking layer; whether a given use of PHI needs an authorization depends on your facts, so talk to your counsel.
Sources, checked November 2, 2026: HHS, Summary of the HIPAA Privacy Rule; HHS, Use of Online Tracking Technologies; HHS, Regulatory Initiatives; eCFR, 45 CFR 160.102, 160.103, 164.500, 164.501, 164.502, 164.508, 164.520, 164.522, 164.524, 164.528 and 164.530; Federal Register, 90 FR 898 (2025).
Frequently Asked Questions
What is the HIPAA Privacy Rule?
It is the federal rule, in effect since April 14, 2003 for most covered entities, that sets national standards for how health plans, clearinghouses, covered providers and their business associates may use and disclose PHI, and gives patients rights over their records (HHS).
What does the HIPAA Privacy Rule primarily aim to do?
HHS says its major goal is "to assure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well being" (HHS).
What are the HIPAA privacy rules?
Use or disclose PHI only as the rule permits or the patient authorizes; limit it to the minimum necessary; get an authorization for most marketing uses of PHI and any sale; honor patient rights; and name a privacy official, train staff and keep documentation for six years (HHS; 45 CFR 164.530).
How does the Privacy Rule define marketing?
As "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service," minus cost-based refill reminders and treatment or care communications for which the covered entity is not paid by a third party (45 CFR 164.501). Marketing that uses PHI needs an authorization unless it is face to face or a promotional gift of nominal value (45 CFR 164.508).
Does the Privacy Rule apply to my website?
If you are a covered entity or business associate and your site collects PHI, yes. HHS says regulated entities may not let tracking technologies make impermissible disclosures of PHI, and that a cookie banner is not a valid HIPAA authorization (HHS). A court vacated the part of that guidance about unauthenticated pages that only connect an IP address with a visit about health conditions or providers (HHS).
What is the new HIPAA rule in 2026?
HHS says compliance with the remaining notice of privacy practices changes "is required by February 16, 2026," while its Security Rule update is still a proposed rule, published January 6, 2025 (HHS; Federal Register). See the new HIPAA rules in 2026.
Talk to Curve Compliance
Book a call. Want your ads measured without sending PHI to ad platforms? Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.